A vulnerability exists in the trainer_search.php page of Simple Gym Management System version 1.0, allowing an attacker to inject arbitrary SQL commands. The flaw is a classic input validation weakness (CWE‑89) that can enable an attacker to read, modify, or delete sensitive data stored in the system’s database. The impact is a compromise of data confidentiality and integrity for any user data accessed through the trainer_search.php endpoint.

The product affected is Carmelo’s Simple Gym Management System, version 1.0. The weakness exists on the web server handling requests to /gym/trainer_search.php.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation at this time. The flaw is not listed in CISA’s KEV catalog, but the web‑based nature of the vulnerable endpoint implies that the likely attack vector is remote. No explicit prerequisites are mentioned, but the attacker would need to be able to send a request to the trainer_search.php endpoint to exploit the injection.